The Hospice of North Idaho (HONI) has agreed to pay the U.S. Department of Health and Human Services (HHS) $50,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. This is the first settlement involving a breach of electronic protected health information (ePHI) affecting fewer than 500 individuals.
The HHS Office for Civil Rights (OCR) began its investigation after HONI reported to HHS that an unencrypted laptop computer containing the ePHI of 441 patients had been stolen in June 2010. During the investigation, OCR says it discovered HONI had not conducted a risk analysis to safeguard ePHI. Further, HONI did not have policies or procedures to address mobile device security as required by the HIPAA Security Rule, OCR adds.
Since the June 2010 theft, HONI has taken extensive additional steps to improve its HIPAA privacy and security compliance program, according to HHS.
“This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients’ health information,” says OCR Director Leon Rodriguez. “Encryption is an easy method for making lost information unusable, unreadable and undecipherable.”
The Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to the Secretary of HHS and the media within 60 days after the discovery of the breach. Smaller breaches affecting less than 500 individuals must be reported to the Secretary annually.
OCR and the HHS Office of the National Coordinator for Health Information Technology (ONC) have launched a new educational initiative, "Mobile Devices: Know the RISKS. Take the STEPS. PROTECT and SECURE Health Information," that offers health care providers and organizations practical tips on ways to protect their patients’ health information when using mobile devices such as laptops, tablets and smartphones. More information is available at www.HealthIT.gov/mobiledevices.
The Resolution Agreement can be found on the OCR website at www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/honi-agreement.pdf.